Efficient factorization with a single pure qubit and logN mixed qubits 
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It is commonly assumed that Shor's quantum algorithm for the efficient factorization of a large 
number A'^ requires a pure initial state. Here we demonstrate that a single pure qubit together with a 
collection of log2N qubits in an arbitrary mixed state is sufficient to implement Shor's factorization 
algorithm efficiently. 

Pacs No: 03.67.-a, 3.67.Lk 



in ■ 
o ■ 
o ■ 

(N . 

> : 
o 

^. 
o : 

(N . 
cn ■ 

> ; 
\o . 
\o ■ 
o ■ 

^ ■ 

o 

o ■ 
o ■ 

:^ 

Oh 

a 

^ : 



The discovery of a quantum algorithm for the efficient 
factorization of large numbers [1] has started a rapid de- 
velopment of quantum information processing [2]. Fol- 
lowing this ground-breaking result a number of experi- 
mentally realizable proposals for the implementation of 
quantum computers have been made, for example, in ion 
trap systems [3] or Nuclear Magnetic Resonance (NMR) 
schemes [4] . These systems are distinguished by a low de- 
coherence rate combined with a comparatively high gate 
speed and therefore promise the possibility of executing 
many quantum gates. While noise in these systems can 
be made small in principle, it nevertheless imposes limi- 
tations to the maximal size of the computation [5] and to 
the achievable quality (e.g. the purity) of the initial state 
of the quantum computer. It would therefore be inter- 
esting to see whether a quantum computation necessarily 
requires the preparation of an initial state of high purity, 
or whether some parts of the quantum computer may be 
left in a mixed state. Such a result would be of partic- 
ular interest in NMR systems in which it is difficult to 
prepare physically pure quantum states of nuclear spins. 

The use of mixed states in quantum algorithms has had 
little discussion as yet. Note, however, the work of Schul- 
man and Vazirani [7] in which they demonstrated that, 
starting from a set of qubits each in a thermal state, one 
can obtain a certain number of pure qubits using a quan- 
tum algorithm. These were then envisaged to be used 
for a quantum computation, while all the other qubits 
which are in a mixed state are discarded. If the initial 
states are in a thermal mixture at high temperature, the 
number of mixed quantum states and quantum gates re- 
quired to obtain even a single pure qubit is very high. It 
would greatly enhance the efficiency of this approach if 
it would be possible to reduce the necessary number of 
pure qubits as much as possible at the expense of em- 
ploying some of the mixed qubits in the actual quantum 
computation. Recently, Knill and Laflamme [6] have in- 
vestigated the power of quantum computation when only 
a single pure qubit together with a supply of maximally 
mixed states is available. They were able to construct 
a problem that such a system can solve more efficiently 
than the best currently known classical algorithm. 

It would be interesting to see whether these ideas can 



be extended to other problems of practical relevance. In 
this paper we demonstrate that a single pure qubit to- 
gether with an initial supply of logj N qubits in an ar- 
bitrarily mixed state is sufficient to implement Shor's 
algorithm for the factorization of the number N effi- 
ciently. This is the smallest number of pure states that 
can achieve this task. We also demonstrate that the ef- 
ficiency of the modified algorithm is essentially indepen- 
dent of the degree of mixing of the logj N qubits. 

We proceed by outlining the problem addressed in 
Shor's algorithm, followed by the formulation of Shor's 
algorithm introduced in [8]. Then we will describe the 
necessary modifications to this algorithm, that will allow 
it to be executed using a single pure qubit and logj N 
qubits in a maximally mixed state. 

The basis of Shor's algorithm is a classical order find- 
ing method which, recast as a quantum algorithm, can 
be executed in polynomial time, requiring only a polyno- 
mial amount of additional classical computation to com- 
pute the factors of N. The factors of a number N ^ pq 
can, with high probability, be found if the period or 
order, r, (the lowest positive integer x ^ such that 
fa{x) = 1 ) of the element a in the space of the function 
.fa{x) — a^mod A^, is known. Then, provided a is coprime 
to N (which can be checked classically in polynomial time 
using Euclid's algorithm), there is a high probability that 
gcd(a5 ± 1, N) yields a factor of N , where gcd(a, (3) de- 
notes the greatest common divisor of a and [3 which, 
again, can be determined efficiently using Euclid's algo- 
rithm [1]. 

We begin by examining the formulation of Shor's al- 
gorithm as given in [8] and use it as a basis to demon- 
strate the main result of this paper. First of all we in- 
troduce the transformation Ua\x) = lax mod A^) where 
x = 0, • • • , iV — 1. Provided a is coprime to N this is a 
unitary transformation and has eigenvectors 



) = ^ I mod N) j = 0, 



1 (1) 



k=Q 



with corresponding eigenvalues e >■ . Given one of these 
eigenvectors we can apply Ua to it and the value of r will 
be encoded in the phase, . This, however, is a global 
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phase which wc cannot measure so instead we can use the 
"phase-kickback" technique [8] requiring the conditional 
unitary transformation given by 

cUa |0) \x) = |0) \x) ; cUa |1) \x) = |1) laxmodTV) . (2) 

The effect of applying the controlled unitary transform 
to the state (|0) + |1)) Itpj) is 



cC/„(|0) + |l))|V,) = (|0) 



■e^|l))|^, 



(3) 



'kicking' the 'global' phase shift acquired on the second 
qubit into a relative phase in the first qubit. We can 
now perform measurements on the first qubit which will 
allow us to estimate r, however, we cannot create the 
eigenstates of Ua without knowledge of r. Instead one 



can use the fact [8] that X]^=o IV-'j) = |1} ^nd condition- 
ally apply Ua to the state (1) (which obviously requires 
no knowledge of r) in the second qubit 



cC/„(|0) + |l))|l) 



i=o 



(4) 



This state is, of course, entangled, so when we make mea- 
surements on the first qubit we will get an estimate of 
, with j (which corresponds to an eigenstate) se- 
lected at random. 

How do we estimate this phase and the value of r ac- 
curately? The network in Fig. 1 will give us, with a suf- 
ficient probability, the best L-bit estimate of the value of 
2^j/r [8]. 
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FIG. 1. An implementation of Shor's algorithm [8]. The controlled Ua operations produce phase shifts related to the 
order of Ua and the remaining Hadamard transformations (H) and controlled rotations Rj = {q^] 
implement the inverse Fourier transform. 
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As the algorithm proceeds it uses the controlled 
Ua,Ua,Ua , • • • , t/^ transformations to produce the 

'kicked' phases , , j • • ' i e ^ into the 
upper 'control' qubits. The remaining operations on the 
control qubits realise the quantum inverse Fourier trans- 
form. A measurement on each of these qubits produces 
a binary number c = J2i=o ^'m^ such that with a fi- 
nite probability is the best estimate oi j/r for some 
integer j again selected at random on measurement. 

The first modification to this algorithm comes when 
wc notice that the gates within the Fourier transform 
are applied sequentially on the qubits. Thus instead of 
performing the entire transform and then making mea- 
surements on all control qubits afterwards we may apply 
the single qubit (Hadamard) operation to the first qubit 
and then measure it. The operations (controlled phase 
shifts) controlled by this first qubit are then replaced by 
single qubit operations given the result of the measure- 



m,ent on the first. This 'semi-classical' modification [10] 
preserves the probabilities of all measurement results. 

Taking this further we need only insist on one control 
qubit and the remaining [log2 N'\ qubits as we can 're- 
cycle' the control qubit after each measurement (Fig. 2): 
wc perform all the necessary operations of the first con- 
trol qubit including measurements, followed by all the op- 
erations of the second control qubit on the same physical 
qubit system given the results of previous measurements, 
and so on [11]. 

We can, therefore, already implement Shor's algorithm 
with 1 -I- [log2 iV] pure qubits that is, one control qubit 
and [log2 iV] of the remaining qubits. We will find later 
that we can also replace the [log2 Af] pure qubits with 
[log2 maximally mixed qubits and find the order r 
efficiently (see also [12]). To see why this is the case we 
first need to examine the unitary transformation Ua more 
closely. 
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FIG. 2. An implementation of Shor's algorithm using only one control qubit which is recycled. R'j are now combi- 



nations of the rotations Rj given the results of previous measurements: R'j = (g^i) with cf)'j = e ^'^'^1=2' 



The unitarity of the transform together with the fact 
that it maps a 'number' state \x) to a 'number' state 
I ax mod iV) means that on repeated application of [/„ 
periodic sequences are induced on aU the numbers x = 
0,1,---,N — 1, that is, there is an R{x) such that 
Ua^^^ \x) = \x). We may vi^rite the members of all pos- 
sible sequences as j^ia^ mod N) for some g and x. For ex- 
ample, for a = 2 and A'' = 15 on repeated application of 
Ua the possible sequences are 



9 = 1: 


|1>- 


|2)- 


|4) - |8) - |1) 




g = 3: 


|3)- 


|6)- 


|12) |9) - |3> 




9 = 5: 


|5)- 


|10)- 


.|5) 




g = 7: 


|7)- 


|14)- 


H13)^|11)^|7). 


(5) 



It is the first of these sequences (with = 1) whose 
number of members is what we previously called the 
'order', r, of a modulo N and it is this period that we 
need to find to factorize N. However, there is a relation- 
ship between the order of the sequence with 9=1 and 
the orders of all the other sequences with g ^ 1. We 
will label each of the different sequences by d and the 
number of members in each sequence by r^. Ua obeys 
the condition = I so it is clear that r^jr, that is, the 
orders of all the sequences divides that of the sequence 
with g = 1. In fact we will find that nearly all of the 
numbers 0, 1, • • • , — 1 are contained within a sequence 
that has the same order as the first sequence. We can 
find a lower bound on the probability that for a number 
g G 0,1, ■ ■ ■ , N — 1 the state j^fa^modA'") is contained 
within a sequence of order r. 

Theorem 1 Given two prime numbers p and q 
we define r as the lowest positive integer x such that 

— 1 = Omod{pq) for an arbitrary integer a. Then 
ga^ — g = mod (pq) with x < r for at most p + q — 1 
values of g in the interval < a < pq — 1. 

Proof: If gcd{g,pq) = 1 then g{a'^ — 1) = Omodpq => 

— 1 = Omodpq and therefore x = r. There are 
{p — l){q — 1) positive integers less than and coprime 
to pq, which proves the theorem □ 

We can now see that the probability, Pr, of picking 
g at random such that the lowest x for which ga^ = 
gmod{pq) is r, is > {pq- {p + q-l))/pq= ip-l){q- 
1)1 pq which approaches unity as p and q become large. 



This tells us that if we set up an algorithm that actu- 
ally finds the order of a random sequence we still have a 
good chance that this order is in fact r. 

The r eigenstates of Ua in equation 1 are orthogonal su- 
perpositions of the members of the sequence with g = 1. 
In exactly the same way we can form the remaining N — r 
eigenstates of Ua as orthogonal superpositions of mem- 
bers of each of the other sequences. We write these as 



d ) 
3d/ 



E 

fe=0 



gaa'' mod N) 



(6) 



where d labels the sequence and Jd = 0, • • • , — 1 the 

eigenstates of Ua within the sequence d. \gd) is the lowest 
member of the dth sequence. Each eigenstate has corre- 
sponding eigenvalue ^'^'^iil'^i so using the same phase 
estimation techniques allows us to estimate jd/'^d given 
the state jV'jd)- Again, this requires knowledge of the 
sequences induced by Ua so instead we may perform the 
phase estimation technique on the maximally mixed state 
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TV 



N-l 



■i-d-l 



N 



fc=0 



(7) 



Phase estimation now estimates the value of jd/rd for jd 
and d chosen at random but as we have seen above nearly 
all the orders rd are equal to r. 

Note that in Shor's original algorithm the [log2 iV] 
qubits encode a phase change into the control qubits 
which is quantum mechanically correlated to eigenstates 
of Ua our modification encodes a phase change which is 
classically correlated to the eigenstates. This includes not 
only the group of eigenstates consisting of superpositions 
of elements in the first sequence (see Eq. 5) but groups 
of eigenstates consisting of superpositions of elements in 
each of the other sequences. However by theorem 1 most 
of these sequences have the same order and will encode 
the value Vd = r into the control qubits. This makes 
it intuitively clear that the algorithm is still efficient. 
Note however that although the [logj A^] mixed qubits 
are only classically correlated to the pure qubit, entan- 
glement still exists in the system: one can partition the 
system into two halves one containing some mixed qubits 
and the other containing the remaining mixed qubits and 
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the pure qubit. Then it can be checked, that this bipar- 
tite system can have negative partial transpose and is 
therefore entangled [13]. 

In the following wc will prove strictly that this mod- 
ified version of Shor's algorithm is indeed still efficient 
for order finding. Shor's algorithm requires O (log log r) 
repetitions for it to have a high chance of finding the 
order whereas the mixed state Shor's algorithm uses ex- 
actly the same resources as Shor's original algorithm but 
requires 



O 



pq 



log log r 



(8) 



repetitions for it to have a high chance of finding the or- 
der which, in the limit p, g — > oo, is equally as efficient as 
Shor's algorithm. For simplicity we will prove this effi- 
ciency result for a mixed state algorithm with L control 
qubits. For the reasons outlined above the result will be 
identical using a single pure control qubit. The proof 
follows very closely that of Shor [1]. 

Pick an L such the N"^ < t = 2^ < 2N'^. The initial 
state of our system with all the control qubits grouped 
into the first state is 



r-d-l 



(9) 



a=0 6=0 



d jd=0 



Application of the controlled Ua,U^,- " ■> ^ gates and 
the inverse Fourier transform yields the state 



r-d-l t-1 



P2 



e K'^d * I 



jvt2 E E E 

d jd—0 a,b,k,l—0 

|fc)(/|0K)(^^J. 



-2vib{ ii-i 
e V'-d 



(10) 



We now make a measurement on the first state. The 
probability that the result c is obtained is 



d jd=0 



e I 

a=0 



(11) 



S is just an arithmetic progression and can easily be 
bounded by 



4f2 



for 



1 

<2f 



(12) 



Because t > this is a sufficient condition that given 
c/t there is only one fraction jd/rd with rd < N such that 
the above condition is obeyed. For a given measurement 
result c there are at least {p—l){q — l)/r corresponding 
values of with rd = r by theorem 1. So the prob- 
ability that c/t is the best estimate of a fraction with 
denominator r is 



P'(c) > 



1 



d 3d = '^ 



(13) 



We now require that the numerator, jd, is coprime to r 
otherwise cancellation of common factors will occur in 
jd/f- There arc (f)(r) values of jd which arc less than 
and coprime to r, where (p is Euler's totient function 
[9]. Thus the probability that we can calculate r is 
P > 4:{p—l){q—l)(j){r)/NrTT'^. Using a theorem by Hardy 
and Wright (theorem 328) [9] that (t>{r)/r > (5/ log log r 
for some constant S we find that the number of times 
that wc need run the algorithm to have a high chance of 
finding the period, r nis given by Eq. (8). 

We have thus found that one pure qiibit and a sup- 
ply of maximally mixed qubits is sufficient to implement 
Shor's algorithm, requiring no more resources in terms 
of quantum operations or physical systems than the al- 
gorithm operating on pure quantum states. This implies 
that the algorithm presented here is a 'true' quantum 
algorithm, achieving an exponential speedup using only 
polynomial resources. This may be suprising as the de- 
gree of mixing of the state of the computer is high. How- 
ever, the mixing decrease as the algorithm proceeds but 
never below a mixture of N/rd eigenstates where rd is 
the measured period. Furthermore, it should be noted 
that despite this strong degree of mixing the quantum 
computer actually evolves into an entangled state. It is 
this entanglement that appears to be responsible for the 
computational speedup. 

Maximally mixed states are intuitively a less 'costly' 
resource than pure states but, in fact, we do not need 
to require maximally mixed states: we could equally well 
use any random state (mixed or pure) on which to per- 
form the controlled Ua operations. The average efficiency 
over all these states would then be as we have shown in 
this paper. In particular thermal states of nuclear spins 
(e.g. in NMR), where the occupation of the ground state 
is only slightly greater than that of the first excited state, 
would change the efficiency of this algorithm by only a 
small amount leaving it an efficient algorithm. This abil- 
ity of highly mixed states to support efficient quantum 
computation points towards the possibility of the imple- 
mentation of true quantum computation for example in 
NMR systems. 
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